Vulnerabilities

TI-2026-34280 CVE-2026-46624

Twenty: SQL Injection via the timeZone field

HIGH 76

Twenty is an open source CRM.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00483 Published 2026-05-26 No fix listed CWE-78

TI-2026-32616 CVE-2026-44729

HIGH 73

Twenty is an open source CRM.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00258 Published 2026-05-26 No fix listed CWE-79

TI-2026-21496 CVE-2026-27023

LOW 22

Twenty is an open source CRM.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00231 Published 2026-03-05 Fixed in 1.18 CWE-918

TI-2026-21368 CVE-2026-26720 · GHSA-227p-wwrh-m869

HIGH 82

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00933 Published 2026-03-02 No fix listed CWE-94

TI-2024-18877 CVE-2024-28435 · GHSA-6cqh-4xr5-c65x

MEDIUM 58

The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00411 Published 2024-03-25 No fix listed CWE-918

TI-2024-18876 CVE-2024-28434 · GHSA-x7hp-f23m-66mj

HIGH 66

The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00674 Published 2024-03-25 No fix listed CWE-79